Why do you care if it's "legal"? If you are concerned about the security implications and don't want to do it, then don't do it. If the company won't accept your deposits without it, then go to another investment company. There are hundreds of them out there. I have never, ever had someone ask for a scanned image of my credit card, and I've done business with at least half a dozen investment companies, so this is not a standard industry practice. You have at your disposal a protection far stronger than the ability to bring some sort of legal complaint: You can take your business elsewhere. Doing that doesn't require hiring a lawyer or going to court or anything. You just do it.
All that said, there are ways to avoid creating much additional security risk. I presume you've already given them your name, address, card number, and security code over the phone or through their website, so you've trusted them with this information, and if hackers or the NSA wanted to snoop on your private information, they could have done it then. Okay, a web page might have used https and thus been encrypted while an email is not. So three solutions: (a) If they provide an upload on an https page, use that and you have no more security risk than when you originally entered this information. (b) Put the scanned image into an encrypted file before emailing, like say an encrypted PDF, or encrypt the image file with some other software, and then send them the password in a separate email. (c) You can get fairly decent security by sending the front and back of the card in two separate emails sent at different times. Then a hacker would have to intercept both and be able to connect them to each other.
BTW I wouldn't really worry about the NSA intercepting such emails. I presume that if they want access to your credit card account, they have easier ways to accomplish that than figuring out this unusual system. Unless they have some specific reason to target you or this investment company, they're probably not searching for images of credit cards in emails.